[Wikitech-l] Security and maintenance release: 1.35.7 / 1.37.3 / 1.38.2

I would like to announce the release of MediaWiki 1.35.7, 1.37.3 and 1.38.2! There was no pre-release announcement as the security fixes being included are low risk XSS vulnerabilites that aren't exploitable in the default MediaWiki config. The patches have also been committed to git for a while. These releases also serve as a maintenance release for these branches. While tarballs have already been uploaded as of this e-mail, git tags will follow later on today. An "MediaWiki Extensions Security Release Supplement" e-mail will follow this one, covering security updates for non-bundled extensions. T308473 only applies to MediaWiki > 1.35. Therefore the fix has not been back-ported to 1.35. T309377 only applies to MediaWiki 1.35 due to having guzzlehttp/guzzle 6.5.5. MediaWiki >= 1.36 already had been upgraded to guzzlehttp/guzzle to 7.2. The patch for MediaWiki 1.35 in T309377 was superseded by the subsequent guzzlehttp/guzzle update in T311384. Various patches aimed at PHP 8.0 and PHP 8.1 support have been backported. This should fix a lot of log spam, and MediaWiki should work on both versions. Bug reports on PHP 8.0 and 8.1 are very welcome, and fixes will be back-ported when possible. Please see https://phabricator.wikimedia.org/tag/php_8.0_support/ and https://phabricator.wikimedia.org/tag/php_8.1_support/ for the relevant work boards. == Security fixes == * (T308471) Username is not escaped in the "welcomeuser" message. * (T308473) Username not escaped in the contributions-title message. * (T309377, CVE-2022-29248) Update "guzzlehttp/guzzle" to version 6.5.6. * (T311384, CVE-2022-27776) Update "guzzlehttp/guzzle" to 6.5.8/7.4.5. == Links to all mentioned tasks == * https://phabricator.wikimedia.org/T308471 * https://phabricator.wikimedia.org/T308473 * https://phabricator.wikimedia.org/T309377 * https://phabricator.wikimedia.org/T311384 == Release notes == Full release notes for 1.35.7: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_35/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.35 Full release notes for 1.37.3: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_37/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.37 Full release notes for 1.38.2: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_38/RELEASE-NOTES… https://www.mediawiki.org/wiki/Release_notes/1.38 For information about how to upgrade, see <https://www.mediawiki.org/wiki/Manual:Upgrading> ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.7.tar.gz https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.7.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.7.tar.gz https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.7.zip Patch to previous version (1.35.6): https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.7.patch.gz https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.7.patch.zip GPG signatures: https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.7.tar.gz.… https://releases.wikimedia.org/mediawiki/1.35/mediawiki-core-1.35.7.zip.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.7.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.7.zip.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.7.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.35/mediawiki-1.35.7.patch.zip.sig Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.3.tar.gz https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.3.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.3.tar.gz https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.3.zip Patch to previous version (1.37.2): https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.3.patch.gz https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.3.patch.zip GPG signatures: https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.3.tar.gz.… https://releases.wikimedia.org/mediawiki/1.37/mediawiki-core-1.37.3.zip.sig https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.3.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.3.zip.sig https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.3.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.37/mediawiki-1.37.3.patch.zip.sig Public keys: https://www.mediawiki.org/keys/keys.html ********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.38/mediawiki-1.38.2.tar.gz https://releases.wikimedia.org/mediawiki/1.38/mediawiki-1.38.2.zip Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.38/mediawiki-core-1.38.2.tar.gz https://releases.wikimedia.org/mediawiki/1.38/mediawiki-core-1.38.2.zip Patch to previous version (1.38.1): https://releases.wikimedia.org/mediawiki/1.38/mediawiki-1.38.2.patch.gz https://releases.wikimedia.org/mediawiki/1.38/mediawiki-1.38.2.patch.zip GPG signatures: https://releases.wikimedia.org/mediawiki/1.38/mediawiki-core-1.38.2.tar.gz.… https://releases.wikimedia.org/mediawiki/1.38/mediawiki-core-1.38.2.zip.sig https://releases.wikimedia.org/mediawiki/1.38/mediawiki-1.38.2.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.38/mediawiki-1.38.2.zip.sig https://releases.wikimedia.org/mediawiki/1.38/mediawiki-1.38.2.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.38/mediawiki-1.38.2.patch.zip.sig Public keys: https://www.mediawiki.org/keys/keys.html